- New upstream release 1.11.0
- Adds support for encrypt-then-mac (ETM) MACs
- Adds support for AES-GCM crypto protocols
- Adds support for sk-ecdsa-sha2-nistp256 and sk-ssh-ed25519 keys
- Adds support for RSA certificate authentication
- Adds FIDO support with *_sk() functions
- Adds RSA-SHA2 key upgrading to OpenSSL, WinCNG, mbedTLS, OS400 backends
- Adds Agent Forwarding and libssh2_agent_sign()
- Adds support for Channel Signal message libssh2_channel_signal_ex()
- Adds support to get the user auth banner message libssh2_userauth_banner()
- Adds LIBSSH2_NO_{MD5, HMAC_RIPEMD, DSA, RSA, RSA_SHA1, ECDSA, ED25519,
AES_CBC, AES_CTR, BLOWFISH, RC4, CAST, 3DES} options
- Adds direct stream UNIX sockets with libssh2_channel_direct_streamlocal_ex()
- Adds wolfSSL support to CMake file
- Adds mbedTLS 3.x support
- Adds LibreSSL 3.5 support
- Adds support for CMake "unity" builds
- Adds CMake support for building shared and static libs in a single pass
- Adds symbol hiding support to CMake
- Adds support for libssh2.rc for all build tools
- Adds .zip, .tar.xz and .tar.bz2 release tarballs
- Enables ed25519 key support for LibreSSL 3.7.0 or higher
- Improves OpenSSL 1.1 and 3 compatibility
- Now requires OpenSSL 1.0.2 or newer
- Now requires CMake 3.1 or newer
- SFTP: Adds libssh2_sftp_open_ex_r() and libssh2_sftp_open_r() extended APIs
- SFTP: No longer has a packet limit when reading a directory
- SFTP: Now parses attribute extensions if they exist
- SFTP: No longer will busy loop if SFTP fails to initialize
- SFTP: Now clear various errors as expected
- SFTP: No longer skips files if the line buffer is too small
- SCP: Add option to not quote paths
- SCP: Enables 64-bit offset support unconditionally
- Now skips leading \r and \n characters in banner_receive()
- Enables secure memory zeroing with all build tools on all platforms
- No longer logs SSH_MSG_REQUEST_FAILURE packets from keepalive
- Speed up base64 encoding by 7x
Assert if there is an attempt to write a value that is too large
- WinCNG: fix memory leak in _libssh2_dh_secret()
- Added protection against possible null pointer dereferences
- Agent now handles overly large comment lengths
- Now ensure KEX replies don't include extra bytes
- Fixed possible buffer overflow when receiving SSH_MSG_USERAUTH_BANNER
- Fixed possible buffer overflow in keyboard interactive code path
- Fixed overlapping memcpy()
- Fixed Windows UWP builds
- Fixed DLL import name
- Renamed local RANDOM_PADDING macro to avoid unexpected define on Windows
- Support for building with gcc versions older than 8
- Improvements to CMake, Makefile, NMakefile, GNUmakefile, autoreconf files
- Restores ANSI C89 compliance
- Enabled new compiler warnings and fixed/silenced them
- Improved error messages
- Now uses CIFuzz
- Numerous minor code improvements
- Improvements to CI builds
- Improvements to unit tests
- Improvements to doc files
- Improvements to example files
- Removed "old gex" build option
- Removed no-encryption/no-mac builds
- Removed support for NetWare and Watcom wmake build files
- Avoid use of deprecated patch syntax
- Build static library but don't package it since it's required for the
test suite (https://github.com/libssh2/libssh2/issues/1056)
- Remove redundant references to %{_libdir} from pkgconfig file
- Add patch to work around strict permissions issues for sshd tests
In 8.8 OpenSSH disabled sha1 rsa-sha keys out of the box,
so we need to re-enable them as a workaround for the test
suite until upstream updates the tests.
See: https://github.com/libssh2/libssh2/issues/630
Drop other test workarounds, none of them being needed any longer.
- New upstream release 1.10.0
- Adds agent forwarding support
- Adds OpenSSH Agent support on Windows
- Adds ECDSA key support using the Mbed TLS backend
- Adds ECDSA cert authentication
- Adds diffie-hellman-group14-sha256, diffie-hellman-group16-sha512,
diffie-hellman-group18-sha512 key exchanges
- Adds support for PKIX key reading when using ed25519 with OpenSSL
- Adds support for EWOULDBLOCK on VMS systems
- Adds support for building with OpenSSL 3
- Adds support for using FIPS mode in OpenSSL
- Adds debug symbols when building with MSVC
- Adds support for building on the 3DS
- Adds unicode build support on Windows
- Restores os400 building
- Increases min, max and opt Diffie Hellman group values
- Improves portability of the make file
- Improves timeout behaviour with 2FA keyboard auth
- Various improvements to the Wincng backend
- Fixes reading partial packet replies when using an agent
- Fixes Diffie Hellman key exchange on Windows 1903+ builds
- Fixes building tests with older versions of OpenSSL
- Fixes possible multiple definition warnings
- Fixes potential cast issues _libssh2_ecdsa_key_get_curve_type()
- Fixes potential use after free if libssh2_init() is called twice
- Improved linking when using Mbed TLS
- Fixes call to libssh2_crypto_exit() if crypto hasn't been initialized
- Fixes crash when loading public keys with no id
- Fixes possible out of bounds read when exchanging keys
- Fixes possible out of bounds read when reading packets
- Fixes possible out of bounds read when opening an X11 connection
- Fixes possible out of bounds read when ecdh host keys
- Fixes possible hang when trying to read a disconnected socket
- Fixes a crash when using the delayed compression option
- Fixes read error with large known host entries
- Fixes various warnings
- Fixes various small memory leaks
- Improved error handling, various detailed errors will now be reported
- Builds are now using OSS-Fuzz
- Builds now use autoreconf instead of a custom build script
- cmake now respects install directory
- Improved CI backend
- Updated HACKING-CRYPTO documentation
- Use markdown file extensions
- Improved unit tests
- New upstream release 1.9.0
- Adds ECDSA keys and host key support when using OpenSSL
- Adds ED25519 key and host key support when using OpenSSL 1.1.1
- Adds OpenSSH style key file reading
- Adds AES CTR mode support when using WinCNG
- Adds PEM passphrase protected file support for libgcrypt and WinCNG
- Adds SHA256 hostkey fingerprint
- Adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path()
- Adds explicit zeroing of sensitive data in memory
- Adds additional bounds checks to network buffer reads
- Adds the ability to use the server default permissions when creating sftp directories
- Adds support for building with OpenSSL no engine flag
- Adds support for building with LibreSSL
- Increased sftp packet size to 256k
- Fixed oversized packet handling in sftp
- Fixed building with OpenSSL 1.1
- Fixed a possible crash if sftp stat gets an unexpected response
- Fixed incorrect parsing of the KEX preference string value
- Fixed conditional RSA and AES-CTR support
- Fixed a small memory leak during the key exchange process
- Fixed a possible memory leak of the ssh banner string
- Fixed various small memory leaks in the backends
- Fixed possible out of bounds read when parsing public keys from the server
- Fixed possible out of bounds read when parsing invalid PEM files
- No longer null terminates the scp remote exec command
- Now handle errors when Diffie Hellman key pair generation fails
- Fixed compiling on Windows with the flag STDCALL=ON
- Improved building instructions
- Improved unit tests
- Needs OpenSSL ≥ 1.0.1 now as ECC support is assumed
- Modernize spec somewhat as EL-6 can no longer be supported
- New upstream release 1.8.1
- Fixed possible integer overflow when reading a specially crafted packet
(CVE-2019-3855)
- Fixed possible integer overflow in userauth_keyboard_interactive with a
number of extremely long prompt strings (CVE-2019-3863)
- Fixed possible integer overflow if the server sent an extremely large
number of keyboard prompts (CVE-2019-3856)
- Fixed possible out of bounds read when processing a specially crafted
packet (CVE-2019-3861)
- Fixed possible integer overflow when receiving a specially crafted exit
signal message channel packet (CVE-2019-3857)
- Fixed possible out of bounds read when receiving a specially crafted exit
status message channel packet (CVE-2019-3862)
- Fixed possible zero byte allocation when reading a specially crafted SFTP
packet (CVE-2019-3858)
- Fixed possible out of bounds reads when processing specially crafted SFTP
packets (CVE-2019-3860)
- Fixed possible out of bounds reads in _libssh2_packet_require(v)
(CVE-2019-3859)
- Fix mis-applied patch in the fix of CVE-2019-3859
- https://github.com/libssh2/libssh2/issues/325
- https://github.com/libssh2/libssh2/pull/327
- scp: Do not NUL-terminate the command for remote exec (#1489736, GH#208)
- Make devel package dependency on main package arch-specific
- Drop EL-5 support
- noarch sub-packages always available now
- Drop legacy Group: and BuildRoot: tags
- Drop explicit buildroot cleaning
- %{__isa_bits} always defined now
- New upstream release 1.8.0
- Added a basic dockerised test suite
- crypto: Add support for the mbedTLS backend
- See RELEASE-NOTES for details of bug fixes
- New upstream release 1.7.0
- diffie_hellman_sha256: Convert bytes to bits (CVE-2016-0787); see
http://www.libssh2.org/adv_20160223.html
- libssh2_session_set_last_error: Add function
- See RELEASE-NOTES for details of bug fixes
- New upstream release 1.5.0
- See RELEASE-NOTES for details of bug fixes and enhancements
- Security Advisory for CVE-2015-1782, using SSH_MSG_KEXINIT data unbounded
David Abdurachmanov
Fedora Release Engineering
Paul Howarth
Todd Zullinger
Sahana Prasad
Kamil Dudka
Igor Gnatenko
Tomas Mraz
Peter Robinson
Dennis Gilmore